PT-2026-26087 · WordPress · Nextgen Gallery

Athiwat Tiprasaharn

+2

·

Publicado

2026-03-18

·

Atualizado

2026-03-19

·

CVE-2026-1463

CVSS v3.1

8.8

Alta

VetorAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions NextGEN Gallery versions prior to 4.0.4
Description The NextGEN Gallery plugin for WordPress is susceptible to a Local File Inclusion issue. This affects versions up to and including 4.0.3. The issue is triggered through the template parameter within gallery shortcodes. Successful exploitation allows authenticated attackers with Author-level access or higher to include and execute arbitrary .php files on the server. This can lead to bypassing access controls, obtaining sensitive data, or achieving code execution if .php files can be uploaded and included. The vulnerable parameter is template.
Recommendations Update NextGEN Gallery to version 4.0.4 or later.

Correção

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-98

Identificadores relacionados

CVE-2026-1463

Produtos afetados

Nextgen Gallery